K 10
svn:author
V 7
coneill
K 8
svn:date
V 27
1997-10-20T19:42:25.000000Z
K 7
svn:log
V 584
Defect: BUFFset uses the GROW_AMOUNT macro
Versions affected: INN 1.5.1 and derivatives, INN 1.7 (and derivatives)

Symptoms: innd crashes immediately or eventually due to memory corruption.

Trigger:  When BUFFset is used to copy large (>128K) backlogged
channel buffers.

More details:    The GROW_AMOUNT macro is defined in configdata.h as
follows.....

#define GROW_AMOUNT(x)          ((x) < 128 * 1024 ? (x) : 128 * 1024)

The use of this macro to set bp->Size in BUFFset is an error, sinceBUFFset
must work with length greater than 128 * 1024.

Contributed by: Forrest Cavalier

END
